This vulnerability (CVE-2026-49059) in Facebook for WooCommerce involves an Open Redirect (CWE-601) issue where the application improperly handles URL redirection, allowing attackers to redirect users to untrusted external sites. This can be leveraged for phishing attacks by tricking users into visiting malicious websites. The vulnerability affects versions through 3.7.0. The CVSS 3.1 base score is 4.7 (medium), with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and limited confidentiality impact. No vendor-provided patch or remediation details are available, and the product is not a cloud service.

Successful exploitation can lead to phishing attacks by redirecting users to malicious websites, potentially compromising user trust and exposing users to further attacks. The confidentiality impact is limited, and there is no impact on integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users and administrators should be cautious with URLs generated by Facebook for WooCommerce and educate users about the risks of clicking suspicious links. Monitor for vendor updates regarding patches or official mitigations.